@chrysb/alphaclaw 0.9.14 → 0.9.16

package/lib/server/routes/system.js

@@ -28,6 +28,7 @@ const registerSystemRoutes = ({
   doctorService,
 }) => {
   let envRestartPending = false;
+  let openclawSecretRuntimePromise = null;
   const kManagedChannelTokenPattern =
     /^(?:TELEGRAM_BOT_TOKEN|DISCORD_BOT_TOKEN|SLACK_BOT_TOKEN|SLACK_APP_TOKEN)(?:_[A-Z0-9_]+)?$/;
   const kEnvVarsReservedForUserInput = new Set([
@@ -92,6 +93,97 @@ const registerSystemRoutes = ({
     }
     return null;
   };
+  const getEnvFileValue = (key) =>
+    (typeof readEnvFile === "function" ? readEnvFile() : []).find(
+      (entry) => entry?.key === key,
+    )?.value;
+  const normalizeSecretValue = (value) => {
+    if (typeof value !== "string") return "";
+    const trimmed = String(value || "").trim();
+    if (trimmed.length >= 2) {
+      const first = trimmed[0];
+      const last = trimmed[trimmed.length - 1];
+      if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return trimmed.slice(1, -1).trim();
+      }
+    }
+    return trimmed;
+  };
+  const getEnvObject = () => {
+    const env = { ...process.env };
+    for (const entry of typeof readEnvFile === "function" ? readEnvFile() : []) {
+      const key = String(entry?.key || "").trim();
+      if (!key) continue;
+      if (!normalizeSecretValue(env[key])) {
+        env[key] = normalizeSecretValue(entry?.value);
+      }
+    }
+    return env;
+  };
+  const loadOpenclawSecretRuntime = async () => {
+    openclawSecretRuntimePromise ||= Promise.all([
+      import("openclaw/plugin-sdk/secret-input"),
+      import("openclaw/plugin-sdk/runtime-secret-resolution"),
+    ]).then(([secretInput, runtimeSecretResolution]) => ({
+      coerceSecretRef: secretInput.coerceSecretRef,
+      resolveSecretRefValues: runtimeSecretResolution.resolveSecretRefValues,
+    }));
+    return openclawSecretRuntimePromise;
+  };
+  const resolveSecretRefToken = async ({ config, value, env }) => {
+    try {
+      const { coerceSecretRef, resolveSecretRefValues } =
+        await loadOpenclawSecretRuntime();
+      const ref = coerceSecretRef(value, config?.secrets?.defaults);
+      if (!ref) return "";
+      const resolved = await resolveSecretRefValues([ref], { config, env });
+      const refKey = `${ref.source}:${ref.provider}:${ref.id}`;
+      return normalizeSecretValue(resolved.get(refKey));
+    } catch {
+      return "";
+    }
+  };
+  const resolveEnvReference = (value) => {
+    const match = String(value || "").trim().match(/^\$\{([A-Z_][A-Z0-9_]*)\}$/);
+    if (!match) return "";
+    const envKey = match[1];
+    const envValue = process.env[envKey] || getEnvFileValue(envKey);
+    return normalizeSecretValue(envValue);
+  };
+  const getDashboardTokenFromConfig = async () => {
+    const config = readOpenclawConfig({
+      fsModule: fs,
+      openclawDir: OPENCLAW_DIR,
+      fallback: {},
+    });
+    const env = getEnvObject();
+    const configuredToken = config?.gateway?.auth?.token;
+    const resolvedSecretRefToken = await resolveSecretRefToken({
+      config,
+      value: configuredToken,
+      env,
+    });
+    if (resolvedSecretRefToken) return resolvedSecretRefToken;
+    if (typeof configuredToken === "string" && configuredToken.trim()) {
+      const trimmedToken = normalizeSecretValue(configuredToken);
+      if (/^\$\{[A-Z_][A-Z0-9_]*\}$/.test(trimmedToken)) {
+        return resolveEnvReference(trimmedToken);
+      }
+      return trimmedToken;
+    }
+    return normalizeSecretValue(env.OPENCLAW_GATEWAY_TOKEN);
+  };
+  const buildDashboardUrl = (token) =>
+    token ? `/openclaw/#token=${encodeURIComponent(token)}` : "/openclaw";
+  const extractDashboardTokenFromOutput = (stdout) => {
+    const tokenMatch = String(stdout || "").match(/[#?&]token=([^\s&#]+)/);
+    if (!tokenMatch) return "";
+    try {
+      return decodeURIComponent(tokenMatch[1]);
+    } catch {
+      return tokenMatch[1];
+    }
+  };
   const getRawSessionKey = (sessionRow = {}) =>
     String(sessionRow?.key || sessionRow?.sessionKey || sessionRow?.id || "").trim();
   const getRawSessionsFromPayload = (payload) => {
@@ -692,14 +784,22 @@ const registerSystemRoutes = ({
 
   app.get("/api/gateway/dashboard", async (req, res) => {
     if (!isOnboarded()) return res.json({ ok: false, url: "/openclaw" });
+    const token = await getDashboardTokenFromConfig();
+    if (token) {
+      return res.json({
+        ok: true,
+        url: buildDashboardUrl(token),
+        source: "config",
+      });
+    }
     const result = await clawCmd("dashboard --no-open");
     if (result.ok && result.stdout) {
-      const tokenMatch = result.stdout.match(/#token=([a-zA-Z0-9]+)/);
-      if (tokenMatch) {
-        return res.json({ ok: true, url: `/openclaw/#token=${tokenMatch[1]}` });
+      const cliToken = extractDashboardTokenFromOutput(result.stdout);
+      if (cliToken) {
+        return res.json({ ok: true, url: buildDashboardUrl(cliToken) });
       }
     }
-    res.json({ ok: true, url: "/openclaw" });
+    res.json({ ok: true, url: "/openclaw", needsAuth: true });
   });
 
   app.get("/api/restart-status", async (req, res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "publishConfig": {
     "access": "public"
   },
@@ -33,7 +33,7 @@
   "dependencies": {
     "express": "^4.21.0",
     "http-proxy": "^1.18.1",
-    "openclaw": "2026.5.2",
+    "openclaw": "2026.5.6",
     "ws": "^8.19.0"
   },
   "devDependencies": {